feat(k8s): add SOPS + AGE data encryption

kubernetes/flux-system/sops-age-secret.yaml.example

@@ -0,0 +1,9 @@
+# Manual step: create this secret before Flux can decrypt SOPS files
+# kubectl create secret generic sops-age --namespace=flux-system --from-file=age.agekey=<path-to-age.key>
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sops-age
+  namespace: flux-system
+stringData:
+  age.agekey: AGE-SECRET-KEY-XXXXXXXXXXXXXXXXXXXXX